Avada (Fusion) Builder CVE-2026-104729

Requires an authenticated WordPress account with contributor-level privileges or higher on a site running Avada (Fusion) Builder version ≤3.16.2. The attacker injects a script payload into the 'tab_index' or 'empty_notice' shortcode attribute; the flaw exists because wp_kses_post does not strip the payload on save, as the dangerous characters sit within shortcode attribute text between square brackets that kses treats as plain text rather than HTML markup. The stored payload executes only when a user subsequently accesses the injected page. Limiting factors: exploitation is gated by the required contributor+ account (self-registration must be possible or an account otherwise obtained), is confined to sites using the affected builder version, and yields XSS-level impact in a victim's browser rather than direct server compromise.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium) shows network-reachable, low-complexity exploitation but requires PR:L - an authenticated contributor-level (or higher) account - which is the single biggest limiting factor. The scope change (S:C) and C:L/I:L reflect a classic stored XSS impact: script runs in another user's browser context rather than directly compromising the server. No CISA KEV listing, so the status is 'no public exploit identified at time of analysis'; there is no EPSS score in the supplied data and no confirmed proof-of-concept - the only references are a Wordfence threat-intelligence entry and the vendor's security-update blog, neither verified as working exploit code. No SSVC exploitation/automatable/technical-impact triple is provided; the only decision signal is the vuln.today priority label 'this_month', which is consistent with a medium-severity authenticated flaw rather than act-now urgency. Signals are therefore aligned and unremarkable: real but gated behind an authenticated account, best handled on a normal patch cycle. One cross-reference caveat: the affected component is 'Avada (Fusion) Builder' at version ≤3.16.2, yet the vendor fix reference points to an 'Avada 7.16.3 security update' - the product-suite release number, not the plugin number - so the exact fixed plugin build should be verified with the vendor.

An attacker who holds (or registers/obtains) a contributor-level WordPress account on a site running Avada (Fusion) Builder ≤3.16.2 creates or edits a page and places a malicious script inside the 'tab_index' or 'empty_notice' shortcode attribute, where wp_kses_post treats the bracketed attribute text as plain text and does not strip it. When an administrator or other user later views that page, the stored script executes in their browser session. No public working exploit is confirmed in the supplied data, though a Wordfence vulnerability record exists.